PPP & IP Analysis in the ISDN B-Channel 


The main problems encountered by users 
of the Internet connecting via ISDN lines 
are associated with setting up of the link 
and authentication at the Point-to-Point 
Protocol (PPP) level or with the IP routing. 


ISP connections can take place over the 
ISDN bearer channels (B-channel). With 
Aurora Duet, Aurora Sonata or Aurora 
Tempo it is possible to capture this 
B-channel traffic and export it to Aurora 
Expert for analysis. 
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ISDN ACCESS TO THE INTERNET SERVICE PROVIDER 


The main problems encountered by users of the Internet connecting 
via ISDN lines are associated with setting up of the link and 
authentication at the Point-to-Point Protocol (PPP) level or with the IP 
routing. ISP connections can take place over the ISDN bearer channels 
(B-channel). With Aurora Duet, Aurora Sonata or Aurora Tempo it is 
possible to capture this B-channel traffic and export it to Aurora Expert 
for analysis. 
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PPP PROTOCOLS AT WORK 


The Point-to-Point Protocol is used in many systems from ISDN based 
dial-up Internet Service Provision to ADSL access. The PPP is a suit of 
simple protocols that provide a protocol carrying pipe between the user 
PC and the ISP gateway. PPP is therefore a transport protocol for the 
Internet Protocol and higher application layers. 


In its most simple form a PPP session will consist of: 


e A link management protocol called Link Control Protocol (LCP) 


e An Authentication protocol for user security such as Password 
Authentication Protocol (PAP) or CHAP 


e A management protocol for the Internet Protocol called Internet 
Protocol Control Protocol (IPCP) 
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In typical systems within a WAN, other PPP protocols come into play 
such as: 


Compression Control Protocol (CCP) controlling the types of 
compression used on the frames and headers 


Bandwidth Control Allocation Protocol (BCAP) for managing the 
bandwidth used on the link (i.e. multiple B-channels for example) 


Internet Protocol Control Protocol (IPCP) providing management 
and control of compression / encryption of Internet Protocol through 
the PPP pipe. 


The procedure for setting up a PPP link and establishing a connection 
to the Internet via an Internet Service Provider is illustrated in the 
message sequence below: 


PC (DTE) ISP (SERVER) Operation Flow 
Event 2 17:22:00.780 Set-up link using LCP 
Link Control Protocol 
Event 3 17:22:00.797 

Link Control Protocol 
Event 4 17:22:00.799 

Link Control Protocol 
Event 5 17:22:00.816 
Link Control Protocol 
Event 6 17:22:00.824 
Link Control Protocol 
Event 7 17:22:00.867 


Link Control Protocol Notify far end that CHAP 
authentication will take place 


Event 8 17:22:00.870 
Link Control Protocol 
Event 9 17:22:00.887 
Link Control Protocol 
Event 10 17:22:00.916 
Challenge Handshake Authentication Protocol Challenge 
Event 11 17:22:00.938 
Challenge Handshake Authentication Protocol Response 
Event 12 17:22:00.957 
Challenge Handshake Authentication Protocol Success 
Event 13 17:22:00.959 
Internet Protocol Control Protocol Obtain IP address from server 
Event 14 17:22:00.979 
Internet Protocol Control Protocol 
Event 15 17:22:00.982 
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Compression Control Protocol 


Event 16 17:22:00.984 
Internet Protocol Control Protocol 
Event 17 17:22:00.994 
Internet Protocol Control Protocol 
Event 18 17:22:00.998 
Link Control Protocol 
Event 19 17:22:02.959 
Internet Protocol Control Protocol 


Event 20 17:22:02.982 
Internet Protocol Control Protocol 
Event 21 17:22:03.989 
Internet Protocol Control Protocol 
Event 22 17:22:04.004 
Internet Protocol Control Protocol 
Event 23 17:22:04.031 
Internet Protocol Control Protocol 
Event 24 17:22:04.047 
Internet Protocol Control Protocol 
Event 25 17:22:04.087 
Internet Protocol Control Protocol 
Event 26 17:22:04.103 
Internet Protocol Control Protocol 
Event 27 17:22:04.128 
Internet Protocol 
Event 28 17:22:04.202 
Internet Protocol 
Event 29 17:22:04.211 
Internet Protocol 


IPCP set up Van Jacobson 
compression 


Configuration Request 


IP application data frames - 
IP layer now up 
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The trace segment below shows the detail level and information 
provided within the Aurora Expert trace. PASS/FAIL events such as 
PASSWORD acceptance are identified as a success or failure for clear 
and easy diagnosis. 


Event 12 17:22:00.957 24 Jan 2001 
Address = 255 

Control =3 

PPP Protocol (hex) = C223 

Challenge Handshake Authentication Protocol 
SUCCESS 

Identifier = 191 

Length = 4 

FF03C223 

03BF0004 


Event 13 17:22:00.959 24 Jan 2001 
Address = 255 

Control = 3 

PPP Protocol (hex) = 8021 

Internet Protocol Control Protocol 
CONFIGURE REQUEST 

Identifier = 6 

Length = 10 

IP-Address 

Option length =6 

IP-Address 195.30.0.94 
FFO38021 


PPP common failure modes can be broken down into three categories: 


1. Link problems 


This can entail: 


e Physical connection not providing a path to the server device 
¢ The server LCP configuration being faulty 


e The encapsulation method differing between the client and the server 
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2. Account Problems 


This is generally either caused by the account being disabled or 
nonexistent from the server perspective or an error in the 
password/username. It is possible that the server refuses to allocate an 
IP address to the client PC (see routing problems below). 


3. Routing Problems 


This is usually caused by an incorrect server IP address configuration at 
the client PC end of the link. It may also manifest itself as a refusal by 
the server to allocate an IP address to the client (using IPCP 
configuration request with IP address set to 0.0.0.0). In most cases the 
client PC settings are at fault. Assuming a valid Internet account. 


_ 6 © Trend Communications 
an, oo ee www.trendcomms.com 


Aurora Expert 


Aurora Expert provides a comprehensive easy to use protocol decode and analysis package for diagnosis of these problems. To 
assist users of Aurora Expert with analysing PPP and other protocol problems, a flexible filtering application is included. 
Predefined complex filters for a number of related protocols are available to users of Aurora Expert from the Trend WEBsite or 
through Trend Customer Support Helpdesk, preventing the need for in-depth knowledge of filter techniques. These filter files can 
be logically combined to fine-tune the focus directly onto the problem. 


Other optional protocols supported by Aurora Expert include: 


ISDN: DASS2 (UK), VN (France), 1TR6 (Germany), TPH1856 / THP1962 (Australia), Nortel (USA), N.I.(USA), 
AT&T (4ESS/5ESS — USA), DSS1 (ETSI /Q.931), CorNet N/T (Siemens), CorNet TS (Siemens), TN1R6 N/T, Q.SIG, X.25 
(X.31), X.25 (LAPB) 


Access Network: V5.1 & V5.2, 
Frame Relay: ITU-T Q.933 Annex A, ANSI T1.617 Annex D, ‘Gang of Four’ LMI (Original LMI, FRF LMI). 


PPP/IP: LCP, CCP, PAP, CHAP, BAP, BACP, IPCP, OSINLCP, ATCP plus decoding of all RFC 1700 PPP headers, IP 
Aurora Expert is subject to an ongoing development program with continuous addition of new features - call for more information. 
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